Trojan.Siggen14.46280

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7zipsfx.000\kugou.skn
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\kgm.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\icon.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\albumpanelshadow.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\upgrade\icon.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\upgrade\closeico.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\upgrade\loading.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\icon_splice.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\png8.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\tipsbg02.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\new_svip.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\albumpanelshadow02.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\icon_b_right.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\tmpico.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\icon_dialog.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\tipsbg01.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\kgico01.jpg
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\loading.gif
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\icon_dialog2.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\musicbag.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\mv_icon.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\icon_dialog2_2.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\closeico.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\package.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\popupboxbg.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\webloading.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\blue.jpg
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\error.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\icon_dialog2_3.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\icon_dialog_2.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\loading.min.gif
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\js\app.4a9f0498.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\temp\ad002.jpg
%TEMP%\7cbd.tmp.cfg
%TEMP%\adb.log
%HOMEPATH%\.android\adbkey
%HOMEPATH%\.android\adbkey.pub
%APPDATA%\kugou8\net_option.inicfg
%APPDATA%\kugou8\net_option.ini
%APPDATA%\kugou8\webcache\package\skinzone\package_1467776761.zip
%APPDATA%\kugou8\webcache\charging\v_1623298014\css\upgrade\style.css
%APPDATA%\kugou8\webcache\charging\v_1623298014\css\style.css
%APPDATA%\kugou8\webcache\charging\v_1623298014\js\download_modoule.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\js\template.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\js\pc_util.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\js\play_modoule.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\js\upgrade\template.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\banner.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\icon_dialog_3.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\js\upgrade\supercall-v3-min.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\js\send_modoule.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\js\util.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\js\dd_belatedpng_0.0.8a-min.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\js\download_mv.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\js\supercall-v2-min.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\js\pc_util-min.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\js\native.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\js\base-min.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\update.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\new_vip.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\png24.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\temp\tmp003.jpg
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\temp\ad001.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\js\upgrade\upgrade.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\temp\tmp002.jpg
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\albumpicbg.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\new_vip_icon.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\images\vip.png
%TEMP%\7zipsfx.000\lod.dll
%APPDATA%\kugou8\kgmusicv3.db
%APPDATA%\kugou8\downfile.dat
%APPDATA%\kugou8\deamon.dat
%TEMP%\552w87je.cmd
%TEMP%\7zipsfx.000\winusb.dll
%TEMP%\7zipsfx.000\upgrade.dll
%TEMP%\7zipsfx.000\ui.dll
%TEMP%\7zipsfx.000\suite.dll
%TEMP%\7zipsfx.000\ssleay32.dll
%TEMP%\7zipsfx.000\qrcodelib.dll
%TEMP%\7zipsfx.000\popads.dll
%TEMP%\7zipsfx.000\msvcr120.dll
%TEMP%\7zipsfx.000\msvcp120.dll
%TEMP%\7cbd.tmp
%APPDATA%\kugou8\kugou.ini
%TEMP%\7zipsfx.000\libeay32.dll
%TEMP%\7zipsfx.000\kugou.dll
%TEMP%\7zipsfx.000\kgplayer.dll
%TEMP%\7zipsfx.000\help_libevent.dll
%TEMP%\7zipsfx.000\dsp.dll
%TEMP%\7zipsfx.000\codecs.dll
%TEMP%\7zipsfx.000\uninst.exe
%TEMP%\7zipsfx.000\kugou8.exe
%TEMP%\7zipsfx.000\kugou.exe
%TEMP%\7zipsfx.000\kgservice.exe
%TEMP%\7zipsfx.000\kgdaemon.exe
%TEMP%\7zipsfx.000\kg.exe
%TEMP%\7zipsfx.000\kadb.exe
%TEMP%\7zipsfx.000\iebox.exe
%TEMP%\7zipsfx.000\mobileidentifydll.dll
%APPDATA%\kugou8\webcache\charging\v_1623298014\js\upgrade\virtualtable.js
%APPDATA%\kugou8\playlistv3.db
%APPDATA%\kugou8\playlistv3.db-journal
%APPDATA%\kugou8\kgservice_stat.ini
%APPDATA%\kugou8\webcache\charging\v_1623298014\files.json
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\download.html
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\send.html
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\upgrade.html
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\play.html
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\img\default.4c536893.png
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\palyban.html
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\css\sprite.css
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\css\app.78ddfb15.css
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\css\sprite.svg
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\css\app.2b95650c.css
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\intercept.html
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\add.html
%APPDATA%\kugou8\kgmusicv3.db-journal
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\js\app.e1e7a181.js.map
%APPDATA%\kugou8\kgservice_crash.dat
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\js\app.4a9f0498.js.map
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\js\chunk-vendors.d18ed52a.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\js\chunk-vendors.d18ed52a.js.map
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\favicon.ico
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\index.html
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\lib\svg_icons.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\lib\supercall-v3.1.1.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\lib\theme-switch.js
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\build.html
%APPDATA%\kugou8\webcache\charging\v_1623298014\tpl\adiframe.html
%APPDATA%\kugou8\webcache\charging\v_1623298014\tpl\index.html
%APPDATA%\kugou8\webcache\package\charging\package_1623298014.zip
%APPDATA%\kugou8\servers.bin
%APPDATA%\kugou8\webcache\charging\v_1623298014\html\js\app.e1e7a181.js
%TEMP%\etilqs_fnhpwjdtns9y6nv

Присваивает атрибут 'скрытый' для следующих файлов

%TEMP%\552w87je.cmd

Удаляет следующие файлы

%APPDATA%\kugou8\kgservice_stat.ini
%APPDATA%\kugou8\kgmusicv3.db-journal
%APPDATA%\kugou8\playlistv3.db-journal

Изменяет следующие файлы

Подменяет следующие файлы

%APPDATA%\kugou8\kgmusicv3.db-journal

Сетевая активность

Подключается к

'se#######r.service.kugou.com':80
'localhost':5583
'localhost':5581
'localhost':5579
'localhost':5577
'localhost':5575
'localhost':5573
'localhost':5571
'localhost':5569
'localhost':5567
'localhost':5565
'localhost':5563
'localhost':5561
'localhost':5559
'localhost':5585
'localhost':5557
'localhost':5037
'rt####tor.kugou.com':80
'42.##.20.167':80
'co####t.kugou.com':80
'pc###.kugou.com':80
'in####l.kugou.com':80
'11#.#06.27.249':80
'so####art.kugou.com':80
'localhost':49184
'localhost':49182
'so.####ice.kugou.com':80
'st####.kgimg.com':80
'so####at.kugou.com':80
'localhost':5555
'me#####.service.kugou.com':80

TCP

Запросы HTTP GET

http://ww##.kugou.com/k8/html/default.html?ve######
http://ww##.kugou.com/yueku/k8v1/html/default.html?ve######
http://st####.kgimg.com/common/js-lib/min/supercall-v2-min.js
http://www.ku##u.com/check/forbid_v2.png
http://so####at.kugou.com/?ac###############################################

Запросы HTTP POST

http://se#######r.service.kugou.com/

Другие

'localhost':5037
'localhost':49197
'localhost':49199

UDP

DNS ASK tj.##gou.com
DNS ASK pc###.kugou.com
DNS ASK se#######r.service.kugou.com
DNS ASK ww##.kugou.com
DNS ASK ku##u.com
DNS ASK co####t.kugou.com
DNS ASK in####l.kugou.com
DNS ASK me#####.service.kugou.com
DNS ASK so.####ice.kugou.com
DNS ASK rt####tor.kugou.com
DNS ASK in####l2.kugou.com
DNS ASK st####.kgimg.com
DNS ASK so####art.kugou.com
DNS ASK so####at.kugou.com
'17#.#.248.14':21106
'21#.#4.133.26':20481
'11#.#18.210.57':33495
'11#.#37.91.228':8000
'12#.#4.191.76':30199
'11#.#8.26.171':8000
'12#.#3.152.139':13349
'12#.#1.21.41':4997
'11#.#24.180.51':23078
'18#.#40.173.158':26069
'<LOCALNET>.5.255':8000
'12#.#3.183.85':19760
'12#.#2.152.253':9216
'61.##6.117.163':61192
'11#.#08.206.237':8000
'14.##4.62.255':41616
'12#.#36.228.116':17597
'11#.#04.201.237':18115
'11#.#22.238.101':27864
'22#.#88.4.96':13135
'1.##.144.173':15252
'27.##6.142.65':8394
'61.##6.36.32':48960
'18#.#40.142.55':1226
'58.##9.236.114':40751
'27.##6.227.214':3290
'18#.#41.212.140':25989
'1.###.83.113':15102
'11#.#1.153.55':8000
'49.#.81.143':6611
'49.#.81.131':8100
'11#.#31.37.19':7501
'49.##2.80.210':9805
'11#.#31.37.18':8008
'11#.#06.128.50':64325
'49.#.81.143':8707
'49.#.81.109':9638
'11#.#29.171.71':14618
'49.#.81.110':9638
'22#.#81.220.249':3074
'22#.#19.53.142':5888
'36.##.26.222':37490
'11#.#6.103.237':38466
'11#.#39.48.167':6341
'36.#.61.17':53809
'18#.#41.215.79':55691
'<LOCALNET>.5.255':9000
'49.#.81.131':9999
'11#.#3.165.143':33753
'42.#1.35.64':20050
'18#.#1.94.163':18876
'12#.#38.34.85':1190
'14.##6.33.25':34209
'22#.#42.141.228':24346
'18#.#32.64.12':5566

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\7zipsfx.000\kg.exe'
'%TEMP%\7zipsfx.000\kugou8.exe'
'%TEMP%\7zipsfx.000\kugou.exe'
'%TEMP%\7zipsfx.000\kgservice.exe'
'%TEMP%\7zipsfx.000\iebox.exe' --channel=2164.0049F1A8.847043845 --disable-cef
'%TEMP%\7zipsfx.000\kgdaemon.exe' -kugoo -v:7710|1
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\552W87JE.cmd" "%TEMP%\7ZipSfx.000\kg.exe" "' (со скрытым окном)
'%TEMP%\7zipsfx.000\kgdaemon.exe' -kugoo -v:7710|1' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\552W87JE.cmd" "%TEMP%\7ZipSfx.000\kg.exe" "
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%TEMP%\7zipsfx.000\kgservice.exe...
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%TEMP%\7zipsfx.000\kugou.exe"
'%TEMP%\7zipsfx.000\kadb.exe' fork-server server

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней